| gio | 3e1b96b | 2026-07-21 18:52:35 +0400 | [diff] [blame] | 1 | apiVersion: rbac.authorization.k8s.io/v1 |
| 2 | kind: ClusterRole |
| 3 | metadata: |
| 4 | name: longhorn-role |
| 5 | labels: {{- include "longhorn.labels" . | nindent 4 }} |
| 6 | rules: |
| 7 | - apiGroups: |
| 8 | - apiextensions.k8s.io |
| 9 | resources: |
| 10 | - customresourcedefinitions |
| 11 | verbs: |
| 12 | - "*" |
| 13 | - apiGroups: [""] |
| 14 | resources: ["pods"] |
| 15 | verbs: ["get", "list", "watch", "delete", "deletecollection"] |
| 16 | - apiGroups: [""] |
| 17 | resources: ["secrets", "services", "endpoints", "configmaps", "serviceaccounts", "pods/log"] |
| 18 | verbs: ["get", "list", "watch"] |
| 19 | - apiGroups: [""] |
| 20 | resources: ["events", "persistentvolumes", "persistentvolumeclaims", "persistentvolumeclaims/status", "nodes"] |
| 21 | verbs: ["*"] |
| 22 | - apiGroups: [""] |
| 23 | resources: ["namespaces"] |
| 24 | verbs: ["get", "list"] |
| 25 | - apiGroups: ["apps"] |
| 26 | resources: ["daemonsets", "statefulsets", "deployments", "replicasets"] |
| 27 | verbs: ["get", "list", "watch"] |
| 28 | - apiGroups: ["batch"] |
| 29 | resources: ["jobs", "cronjobs"] |
| 30 | verbs: ["get", "list", "watch"] |
| 31 | - apiGroups: ["policy"] |
| 32 | resources: ["poddisruptionbudgets"] |
| 33 | verbs: ["get", "list", "watch"] |
| 34 | - apiGroups: ["scheduling.k8s.io"] |
| 35 | resources: ["priorityclasses"] |
| 36 | verbs: ["watch", "list"] |
| 37 | - apiGroups: ["storage.k8s.io"] |
| 38 | resources: ["storageclasses", "volumeattachments", "volumeattachments/status", "csinodes", "csidrivers", "csistoragecapacities"] |
| 39 | verbs: ["*"] |
| 40 | - apiGroups: ["snapshot.storage.k8s.io"] |
| 41 | resources: ["volumesnapshotclasses", "volumesnapshots", "volumesnapshotcontents", "volumesnapshotcontents/status"] |
| 42 | verbs: ["*"] |
| 43 | - apiGroups: ["longhorn.io"] |
| 44 | resources: ["volumes", "volumes/status", "engines", "engines/status", "replicas", "replicas/status", "settings", "settings/status", |
| 45 | "engineimages", "engineimages/status", "nodes", "nodes/status", "instancemanagers", "instancemanagers/status", |
| 46 | {{- if .Values.openshift.enabled }} |
| 47 | "engineimages/finalizers", "nodes/finalizers", "instancemanagers/finalizers", |
| 48 | {{- end }} |
| 49 | "sharemanagers", "sharemanagers/status", "backingimages", "backingimages/status", |
| 50 | "backingimagemanagers", "backingimagemanagers/status", "backingimagedatasources", "backingimagedatasources/status", |
| 51 | "backuptargets", "backuptargets/status", "backupvolumes", "backupvolumes/status", "backups", "backups/status", |
| 52 | "recurringjobs", "recurringjobs/status", "orphans", "orphans/status", "snapshots", "snapshots/status", |
| 53 | "supportbundles", "supportbundles/status", "systembackups", "systembackups/status", "systemrestores", "systemrestores/status", |
| 54 | "volumeattachments", "volumeattachments/status", "backupbackingimages", "backupbackingimages/status"] |
| 55 | verbs: ["*"] |
| 56 | - apiGroups: ["coordination.k8s.io"] |
| 57 | resources: ["leases"] |
| 58 | verbs: ["get", "list", "watch"] |
| 59 | - apiGroups: ["metrics.k8s.io"] |
| 60 | resources: ["pods", "nodes"] |
| 61 | verbs: ["get", "list"] |
| 62 | - apiGroups: ["apiregistration.k8s.io"] |
| 63 | resources: ["apiservices"] |
| 64 | verbs: ["list", "watch"] |
| 65 | - apiGroups: ["admissionregistration.k8s.io"] |
| 66 | resources: ["mutatingwebhookconfigurations", "validatingwebhookconfigurations"] |
| 67 | verbs: ["get", "list", "create", "patch", "delete"] |
| 68 | - apiGroups: ["rbac.authorization.k8s.io"] |
| 69 | resources: ["roles", "rolebindings"] |
| 70 | verbs: ["get", "list", "watch"] |
| 71 | - apiGroups: ["discovery.k8s.io"] |
| 72 | resources: ["endpointslices"] |
| 73 | verbs: ["get", "list", "watch"] |
| 74 | - apiGroups: ["rbac.authorization.k8s.io"] |
| 75 | resources: ["clusterrolebindings", "clusterroles"] |
| 76 | verbs: ["*"] |
| 77 | {{- if .Values.openshift.enabled }} |
| 78 | --- |
| 79 | apiVersion: rbac.authorization.k8s.io/v1 |
| 80 | kind: ClusterRole |
| 81 | metadata: |
| 82 | name: longhorn-ocp-privileged-role |
| 83 | labels: {{- include "longhorn.labels" . | nindent 4 }} |
| 84 | rules: |
| 85 | - apiGroups: ["security.openshift.io"] |
| 86 | resources: ["securitycontextconstraints"] |
| 87 | resourceNames: ["anyuid", "privileged"] |
| 88 | verbs: ["use"] |
| 89 | {{- end }} |